{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5cf53be8-5746-5052-bad2-e1dc72f8f47b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "urllib3", "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "type": "library", "bom-ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "version": "2.5.0.post2+tuxcare", "pedigree": { "ancestors": [ { "name": "urllib3", "purl": "pkg:pypi/urllib3@2.5.0", "type": "library", "version": "2.5.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-33503", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:f68dcc31-dd1f-51c1-8d52-9c35c96a66a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-33503 affects version 2.5.0.post2+tuxcare of urllib3." } }, { "id": "CVE-2023-43804", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:afe54297-ff63-58ad-b32a-6311e5428090", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-43804 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 CVE-2023-43804 (Cookie header leakage via cross-origin redirects) is not present in urllib3 2.5.0.post2+tuxcare. The upstream fix (commit 644124ec by quentin.pradet@gmail.com) shipped in the 2.5.0 release before TuxCare onboarding. The defense adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be automatically stripped during cross-host redirects. This defense is ena...", "justification": "code_not_present" } }, { "id": "CVE-2023-45803", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:1d3c78a1-d9a8-5e4c-b4d1-7941db86c0a5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45803 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 version 2.5.0.post2+tuxcare is NOT AFFECTED by CVE-2023-45803. The vulnerability (sending HTTP request body and content-specific headers to redirect targets on 303 status responses) does not exist in this version because the upstream vendor (urllib3 project) fixed it in versions 2.0.7 and 1.26.18, which predates TuxCare's onboarding of version 2.5.0. The complete defense is p...", "justification": "code_not_present" } }, { "id": "CVE-2024-37891", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:4d31e481-b482-56d3-b07d-ef9335cee2ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-37891 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is NOT present in urllib3 2.5.0.post2+tuxcare. The vulnerability (leaking Proxy-Authorization header on cross-origin redirects) was fixed by upstream commit accff72e on June 17, 2024, which added \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT. This fix was already present in the upstream 2.5.0 release (June 18, 2025) that TuxCare onboarded. The target code at src/url...", "justification": "code_not_present" } }, { "id": "CVE-2025-50181", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:be1acc0f-c033-5381-a02f-8f5e6136bede", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-50181 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 2.5.0 repository is NOT AFFECTED by CVE-2025-50181. The vulnerability was fixed in upstream commits f05b1329 and 7eb4a2aa, which were already present in the urllib3 2.5.0 release that TuxCare onboarded. Both the main fix (proper handling of the retries parameter in PoolManager.__init__ and using response.retries as fallback in urlopen) and the Emscripten/Node.js fix (setting ...", "justification": "code_not_present" } }, { "id": "CVE-2025-50182", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:ba50522d-ad96-5251-9125-091fbc82f988", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-50182 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 2.5.0.post2+tuxcare is not affected by CVE-2025-50182. Both security fixes (PoolManager redirect control and Pyodide/Node.js Fetch API configuration) were already present in upstream urllib3 2.5.0 that TuxCare onboarded. The vulnerable pattern does not exist in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2025-66418", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:62f7fd39-b67e-509c-9fe1-21a1f9e01151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66418 is fixed in version 2.5.0.post2+tuxcare of urllib3." } }, { "id": "CVE-2025-66471", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:385a7a18-4231-5934-a329-e0d44ed8eb51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66471 is fixed in version 2.5.0.post2+tuxcare of urllib3." } }, { "id": "CVE-2026-21441", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:b41c00d6-0bc3-514a-828d-7519dbf51cf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-21441 is fixed in version 2.5.0.post2+tuxcare of urllib3." } }, { "id": "CVE-2026-44431", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:67f7c7b7-89f9-5792-89bd-4ae8cf14da8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44431 is fixed in version 2.5.0.post2+tuxcare of urllib3." } }, { "id": "CVE-2026-44432", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:cb7f05c8-634d-5aff-a4f1-149e47ab30c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44432 affects version 2.5.0.post2+tuxcare of urllib3." } }, { "id": "CVE-2026-97687", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:0a711587-ab81-58a3-9993-d0e266b04933", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-97687 is fixed in version 2.5.0.post2+tuxcare of urllib3." } }, { "id": "CVE-2026-97688", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:c3829714-3e81-5cc9-87f0-af213d3f871b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-97688 affects version 2.5.0.post2+tuxcare of urllib3." } }, { "id": "CVE-2026-97689", "affects": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:95b9a710-4acb-5c5b-b310-c7f14583d355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-97689 is fixed in version 2.5.0.post2+tuxcare of urllib3." } } ], "dependencies": [ { "ref": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } ] }